38 matches found
CVE-2026-71248: Improper Neutralization of Special Elements used in an SQL Command
Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=...
CVE-2026-10815: Missing Authorization
A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing of the file hostel/index.php of the component Admin Dashboard Page. The manipulation of the argument ID results in missing authorization...
CVE-2026-4623
CVE-2026-4623 affects DefaultFuction Jeson-Customer-Relationship-Management-System up to build 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. The vulnerability resides in the API Module, specifically the file /api/System.php, where manipulation of the url argument enables server-side request forgery (...
PT-2026-27304
Name of the Vulnerable Software and Affected Versions DefaultFuction Jeson-Customer-Relationship-Management-System affected versions not specified Description A security issue has been identified in the API Module component of DefaultFuction Jeson-Customer-Relationship-Management-System...
PT-2026-27196
A Reflected Cross-Site Scripting XSS vulnerability exists in the POST request data zipPath of tiki-admin system.php in Tiki version 21.2. This vulnerability allows attackers to execute arbitrary JavaScript code via a crafted payload, leading to potential access to sensitive information or...
CVE-2025-67147: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in 1 submitcontact.php, the 'username' and 'passkey' parameters in 2 securelogin.php, and the 'loginid', 'pwfield', and 'loginkey' parameters in 3...
CVE-2025-61246: Improper Neutralization of Special Elements used in an SQL Command
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/reviewaction.php via the proId parameter...
CVE-2025-63452
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php...
CVE-2025-63453: Improper Neutralization of Special Elements used in an SQL Command
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php...
CVE-2025-63452: Improper Neutralization of Special Elements used in an SQL Command
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/forgot-pass.php...
CVE-2025-63450: Improper Neutralization of Input During Web Page Generation
Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting XSS in /carlux/booking.php...
CVE-2025-63443: Improper Neutralization of Input During Web Page Generation
School Management System PHP v1.0 is vulnerable to Cross Site Scripting XSS in /login.php via the password parameter...
CVE-2025-63451: Improper Neutralization of Special Elements used in an SQL Command
Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/sign-in.php...
CVE-2025-61247
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php...
CVE-2025-61247: Improper Neutralization of Special Elements used in an SQL Command
indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php...
EUVD-2020-18096
Malware in sbrugna...
EUVD-2024-38437
Malicious code in bioql PyPI...
PT-2025-26294 · Unknown · Phpgurukul Pre-School Enrollment System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Pre-School Enrollment System version 1.0 Description: A critical issue was found in the PHPGurukul Pre-School Enrollment System, affecting an unknown part of the file /enrollment.php. The manipulation of the fathername argument lea...
CVE-2024-25868
A Cross Site Scripting XSS vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the addtype.php component...